Skip to content

Add disableSSHCAUser and disableSSHCAHost attributes to GCP provisioner #1305

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Oct 29, 2024
Merged

Add disableSSHCAUser and disableSSHCAHost attributes to GCP provisioner #1305

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
dfb4907
Add disableSSHCAUser and disableSSHCAHost attributes to GCP provisioner
dopey Oct 28, 2024
93eb7d2
Add --disable-ssh-ca-user and --disable-ssh-ca-host flags ...
dopey Oct 28, 2024
6b13f45
Bump linkedca 0.22.2
dopey Oct 28, 2024
79f96f0
Friendly errors using --disable-ssh-ca-* with Azure or AWS provisioner
dopey Oct 29, 2024
dba3d16
Merge branch 'master' into max/disableSSHCA
dopey Oct 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions command/ca/provisioner/add.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,7 @@
[**--azure-audience**=<name>] [**--azure-subscription-id**=<id>]
[**--azure-object-id**=<id>] [**--instance-age**=<duration>] [**--iid-roots**=<file>]
[**--disable-custom-sans**] [**--disable-trust-on-first-use**]
[**--disable-ssh-ca-user**] [**--disable-ssh-ca-host**]
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This flag is only supported in GCP right now. Should we split this into two usages or return an "unsupported" error if AWS or Azure is used? Returning an error makes more sense to me because we might want to add this functionality to Azure and AWS, too.

[**--admin-cert**=<file>] [**--admin-key**=<file>]
[**--admin-subject**=<subject>] [**--admin-provisioner**=<name>] [**--admin-password-file**=<file>]
[**--ca-url**=<uri>] [**--root**=<file>] [**--context**=<name>] [**--ca-config**=<file>]
Expand Down Expand Up @@ -172,6 +173,8 @@
instanceAgeFlag,
disableCustomSANsFlag,
disableTOFUFlag,
disableSSHCAUserFlag,
disableSSHCAHostFlag,

// Claims
x509TemplateFlag,
Expand Down Expand Up @@ -744,6 +747,13 @@
}

func createAWSDetails(ctx *cli.Context) (*linkedca.ProvisionerDetails, error) {
if ctx.IsSet("disable-ssh-ca-user") {
return nil, errors.New("flag disable-ssh-ca-user is not supported for AWS IID provisioners")
}
if ctx.IsSet("disable-ssh-ca-host") {
return nil, errors.New("flag disable-ssh-ca-host is not supported for AWS IID provisioners")
}

Check warning on line 755 in command/ca/provisioner/add.go

View check run for this annotation

Codecov / codecov/patch

command/ca/provisioner/add.go#L750-L755 

Added lines #L750 - L755 were not covered by tests

d, err := parseInstanceAge(ctx)
if err != nil {
return nil, err
Expand All @@ -764,6 +774,13 @@
}

func createAzureDetails(ctx *cli.Context) (*linkedca.ProvisionerDetails, error) {
if ctx.IsSet("disable-ssh-ca-user") {
return nil, errors.New("flag disable-ssh-ca-user is not supported for Azure IID provisioners")
}
if ctx.IsSet("disable-ssh-ca-host") {
return nil, errors.New("flag disable-ssh-ca-host is not supported for Azure IID provisioners")
}

Check warning on line 782 in command/ca/provisioner/add.go

View check run for this annotation

Codecov / codecov/patch

command/ca/provisioner/add.go#L777-L782 

Added lines #L777 - L782 were not covered by tests

tenantID := ctx.String("azure-tenant")
if tenantID == "" {
return nil, errs.RequiredWithFlagValue(ctx, "type", ctx.String("type"), "azure-tenant")
Expand All @@ -790,13 +807,29 @@
return nil, err
}

var (
disableSSHCAUser *bool
disableSSHCAHost *bool
)

if ctx.IsSet("disable-ssh-ca-user") {
boolVal := ctx.Bool("disable-ssh-ca-user")
disableSSHCAUser = &boolVal
}
if ctx.IsSet("disable-ssh-ca-host") {
boolVal := ctx.Bool("disable-ssh-ca-host")
disableSSHCAHost = &boolVal
}

Check warning on line 822 in command/ca/provisioner/add.go

View check run for this annotation

Codecov / codecov/patch

command/ca/provisioner/add.go#L810-L822 

Added lines #L810 - L822 were not covered by tests

return &linkedca.ProvisionerDetails{
Data: &linkedca.ProvisionerDetails_GCP{
GCP: &linkedca.GCPProvisioner{
ServiceAccounts: ctx.StringSlice("gcp-service-account"),
ProjectIds: ctx.StringSlice("gcp-project"),
DisableCustomSans: ctx.Bool("disable-custom-sans"),
DisableTrustOnFirstUse: ctx.Bool("disable-trust-on-first-use"),
DisableSshCaUser: disableSSHCAUser,
DisableSshCaHost: disableSSHCAHost,

Check warning on line 832 in command/ca/provisioner/add.go

View check run for this annotation

Codecov / codecov/patch

command/ca/provisioner/add.go#L831-L832 

Added lines #L831 - L832 were not covered by tests
InstanceAge: d,
},
},
Expand Down
10 changes: 10 additions & 0 deletions command/ca/provisioner/provisioner.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -542,6 +542,16 @@ with the same instance will be accepted. By default only the first request
will be accepted.`,
}

disableSSHCAUserFlag = cli.BoolFlag{
Name: "disable-ssh-ca-user",
Usage: `Disable ability to sign SSH user certificates`,
}

disableSSHCAHostFlag = cli.BoolFlag{
Name: "disable-ssh-ca-host",
Usage: `Disable ability to sign SSH host certificates`,
}

// Nebula provisioner flags
nebulaRootFlag = cli.StringFlag{
Name: "nebula-root",
Expand Down
26 changes: 26 additions & 0 deletions command/ca/provisioner/update.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,7 @@
[**--azure-audience**=<name>] [**--azure-subscription-id**=<id>]
[**--azure-object-id**=<id>] [**--instance-age**=<duration>]
[**--disable-custom-sans**] [**--disable-trust-on-first-use**]
[**--disable-ssh-ca-user**] [**--disable-ssh-ca-host**]
[**--admin-cert**=<file>] [**--admin-key**=<file>]
[**--admin-subject**=<subject>] [**--admin-provisioner**=<name>] [**--admin-password-file**=<file>]
[**--ca-url**=<uri>] [**--root**=<file>] [**--context**=<name>] [**--ca-config**=<file>]
Expand Down Expand Up @@ -176,6 +177,8 @@
instanceAgeFlag,
disableCustomSANsFlag,
disableTOFUFlag,
disableSSHCAUserFlag,
disableSSHCAHostFlag,

// Claims
x509TemplateFlag,
Expand Down Expand Up @@ -826,6 +829,13 @@
}

func updateAWSDetails(ctx *cli.Context, p *linkedca.Provisioner) error {
if ctx.IsSet("disable-ssh-ca-user") {
return errors.New("flag disable-ssh-ca-user is not supported for AWS IID provisioners")
}
if ctx.IsSet("disable-ssh-ca-host") {
return errors.New("flag disable-ssh-ca-host is not supported for AWS IID provisioners")
}

Check warning on line 837 in command/ca/provisioner/update.go

View check run for this annotation

Codecov / codecov/patch

command/ca/provisioner/update.go#L832-L837 

Added lines #L832 - L837 were not covered by tests

data, ok := p.Details.GetData().(*linkedca.ProvisionerDetails_AWS)
if !ok {
return errors.New("error casting details to AWS type")
Expand Down Expand Up @@ -855,6 +865,13 @@
}

func updateAzureDetails(ctx *cli.Context, p *linkedca.Provisioner) error {
if ctx.IsSet("disable-ssh-ca-user") {
return errors.New("flag disable-ssh-ca-user is not supported for Azure IID provisioners")
}
if ctx.IsSet("disable-ssh-ca-host") {
return errors.New("flag disable-ssh-ca-host is not supported for Azure IID provisioners")
}

Check warning on line 873 in command/ca/provisioner/update.go

View check run for this annotation

Codecov / codecov/patch

command/ca/provisioner/update.go#L868-L873 

Added lines #L868 - L873 were not covered by tests

data, ok := p.Details.GetData().(*linkedca.ProvisionerDetails_Azure)
if !ok {
return errors.New("error casting details to Azure type")
Expand Down Expand Up @@ -914,6 +931,14 @@
if ctx.IsSet("disable-trust-on-first-use") {
details.DisableTrustOnFirstUse = ctx.Bool("disable-trust-on-first-use")
}
if ctx.IsSet("disable-ssh-ca-user") {
boolVal := ctx.Bool("disable-ssh-ca-user")
details.DisableSshCaUser = &boolVal
}
if ctx.IsSet("disable-ssh-ca-host") {
boolVal := ctx.Bool("disable-ssh-ca-host")
details.DisableSshCaHost = &boolVal
}

Check warning on line 941 in command/ca/provisioner/update.go

View check run for this annotation

Codecov / codecov/patch

command/ca/provisioner/update.go#L934-L941 

Added lines #L934 - L941 were not covered by tests
if ctx.IsSet("remove-gcp-service-account") {
details.ServiceAccounts = removeElements(details.ServiceAccounts, ctx.StringSlice("remove-gcp-service-account"))
}
Expand All @@ -926,6 +951,7 @@
if ctx.IsSet("gcp-project") {
details.ProjectIds = append(details.ProjectIds, ctx.StringSlice("gcp-project")...)
}

return nil
}

Expand Down
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ require (
github.com/urfave/cli v1.22.16
go.mozilla.org/pkcs7 v0.9.0
go.step.sm/crypto v0.54.0
go.step.sm/linkedca v0.22.1
go.step.sm/linkedca v0.22.2
golang.org/x/crypto v0.28.0
golang.org/x/sys v0.26.0
golang.org/x/term v0.25.0
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -391,8 +391,8 @@ go.step.sm/cli-utils v0.9.0 h1:55jYcsQbnArNqepZyAwcato6Zy2MoZDRkWW+jF+aPfQ=
go.step.sm/cli-utils v0.9.0/go.mod h1:Y/CRoWl1FVR9j+7PnAewufAwKmBOTzR6l9+7EYGAnp8=
go.step.sm/crypto v0.54.0 h1:V8p+12Ld0NRA/RBMYoKXA0dWmVKZSdCwP56IwzweT9g=
go.step.sm/crypto v0.54.0/go.mod h1:vQJyTngfZDW+UyZdFzOMCY/txWDAmcwViEUC7Gn4YfU=
go.step.sm/linkedca v0.22.1 h1:GvprpH9P4Sv9U+eZ3bxDgRSSpW14cFDYpe1kS6yWLkw=
go.step.sm/linkedca v0.22.1/go.mod h1:dOKdF4HSn73YUEkfS5/FECngZmBtj2Il5DTKWXY4S6Y=
go.step.sm/linkedca v0.22.2 h1:zmFIyDC77gFHo6FLQJ8OIXYpLYDIsgDWaYqtYs6A9/Q=
go.step.sm/linkedca v0.22.2/go.mod h1:ESY8r5VfhJA8ZVzI6hXIQcEX9LwaY3aoPnT+Hb9jpbw=
go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
Expand Down